CVE-2019-20907

Updated: 2025-08-20 02:02:58.450634

Description:

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x MEDIUM 5.0
CVSS Version 3.x HIGH 7.5

Status

OS name Project name Version Score Severity Status Errata Last updated

Statement

Alpine Linux 3.22 python 3.6 7.5 HIGH Already Fixed 2026-01-27 16:43:48
Debian 10 python 3.6 7.5 HIGH Already Fixed 2025-09-05 09:17:27
Debian 10 python 2.7 7.5 HIGH Released CLSA-2025:1760024436 2025-10-10 00:23:32
Debian 11 python 2.7 7.5 HIGH Released CLSA-2025:1760093456 2025-10-10 11:00:05
Debian 11 python 3.6 7.5 HIGH Already Fixed 2025-09-05 09:17:26
Debian 12 python 3.7 7.5 HIGH Not Vulnerable 2025-11-12 16:13:16
Debian 12 python 3.6 7.5 HIGH Already Fixed 2025-09-05 09:17:26
Debian 12 python 2.7 7.5 HIGH Released CLSA-2025:1760093575 2025-10-10 11:00:03
Debian 12 python 3.8 7.5 HIGH Not Vulnerable 2025-11-12 16:13:16
Debian 13 python 3.6 7.5 HIGH Already Fixed 2025-09-29 23:27:16
Total: 31